diff --git a/src/Tahoe/Capability.hs b/src/Tahoe/Capability.hs
index d1393bb7da56111cd2d73c2b2eed8da37e02ec9f..747f7a9c5d25c3c73371806c7a042b0b0f054b38 100644
--- a/src/Tahoe/Capability.hs
+++ b/src/Tahoe/Capability.hs
@@ -1 +1,5 @@
-module Tahoe.Capability where
+module Tahoe.Capability (
+    module Tahoe.Capability.Internal.Confidential,
+) where
+
+import Tahoe.Capability.Internal.Confidential (ConfidentialShowable (..))
diff --git a/src/Tahoe/Capability/Internal/Confidential.hs b/src/Tahoe/Capability/Internal/Confidential.hs
new file mode 100644
index 0000000000000000000000000000000000000000..e6664c5f61e64fa8185aa52e31a5394bfabd4948
--- /dev/null
+++ b/src/Tahoe/Capability/Internal/Confidential.hs
@@ -0,0 +1,12 @@
+module Tahoe.Capability.Internal.Confidential where
+
+import qualified Data.Text as T
+
+{- | Something which contains confidential information and can be rendered as
+ text such that the text also includes confidential information.  It is
+ expected (but not required) that such types will also have a Show instance
+ which obscures the confidential information.
+-}
+class ConfidentialShowable s where
+    -- | Show the value, including any confidential information.
+    confidentiallyShow :: s -> T.Text
diff --git a/tahoe-capabilities.cabal b/tahoe-capabilities.cabal
index d73684e9e72d67cbe4570d1239b7f7e2006bef39..7af4ce996db837f9c34c694b74752d9ae73e9edc 100644
--- a/tahoe-capabilities.cabal
+++ b/tahoe-capabilities.cabal
@@ -64,7 +64,9 @@ library
   import:           warnings
 
   -- Modules exported by the library.
-  exposed-modules:  Tahoe.Capability
+  exposed-modules:
+    Tahoe.Capability
+    Tahoe.Capability.Internal.Confidential
 
   -- Modules included in this library but not exported.
   -- other-modules:
@@ -73,7 +75,9 @@ library
   -- other-extensions:
 
   -- Other library packages from which modules are imported.
-  build-depends:    base ^>=4.14.3.0
+  build-depends:
+    , base
+    , text
 
   -- Directories containing source files.
   hs-source-dirs:   src
@@ -105,5 +109,5 @@ test-suite tahoe-capabilities-test
 
   -- Test dependencies.
   build-depends:
-    , base                ^>=4.14.3.0
+    , base
     , tahoe-capabilities